Cyber Essentials Certification for UK Businesses
Table of Contents
Cyber Essentials is a UK government-backed cybersecurity certification that helps organisations protect their IT systems from common internet-based cyber threats. Developed by the National Cyber Security Centre (NCSC) and delivered through IASME, the scheme assesses five essential security controls.
Businesses can obtain Cyber Essentials through a verified self-assessment or Cyber Essentials Plus, which includes independent technical testing. The certification provides a recognised baseline for cybersecurity, supports certain government procurement requirements, and demonstrates a business’s commitment to protecting information.
This article examines the Cyber Essentials certification process, its key requirements and how organisations can strengthen their cybersecurity practices to meet the certification standards.
Key Takeaways:
- • Cyber Essentials is a UK government-backed certification designed to address common cybersecurity threats through five technical controls.
- • The NCSC owns the scheme, while IASME serves as its delivery partner and works with licensed certification bodies.
- • Businesses can choose between Cyber Essentials and Cyber Essentials Plus, depending on their required level of independent verification.
- • Basic certification fees range from £320 to £600 plus VAT, depending on employee numbers. Cyber Essentials Plus requires an individual quotation.
- • Version 3.3, effective April 27, 2026, introduces updated requirements covering cloud services, passwordless authentication, software development, and backup practices.
What Is Cyber Essentials Certification?
Cyber Essentials is a UK government-backed certification scheme that helps organisations protect themselves against common cyber threats by implementing five fundamental technical security controls.
The scheme provides a recognised baseline for businesses that want to improve their cybersecurity posture and demonstrate their commitment to protecting business information. The scheme was developed by the UK government in collaboration with industry and is supported by the National Cyber Security Centre (NCSC).
Who Runs Cyber Essentials?
Three organisations play important roles in the scheme:
| Organisation | Responsibility |
|---|---|
| National Cyber Security Centre (NCSC) | Owns the scheme and defines its technical requirements. |
| IASME | Acts as the official delivery partner and manages scheme administration. |
| Licensed Certification Bodies | Assess applications and award certificates to organisations that meet the requirements. |
Cyber Essentials was introduced in 2014 as part of the UK’s efforts to improve baseline cybersecurity across businesses and government supply chains.
The scheme has since become an important consideration for organisations working with public-sector buyers and businesses that assess supplier security before establishing commercial relationships.
What Does Cyber Essentials Protect Against?
The certification addresses common cybersecurity weaknesses that attackers frequently target, including:
- • Unprotected internet-facing systems.
- • Devices running outdated software.
- • Weak access permissions.
- • Insecure system configurations.
- • Insufficient malware protection.
These controls reduce exposure to common cyber threats, although additional security measures may be required to address more advanced risks and organisation-specific vulnerabilities. Organisations may require additional measures such as penetration testing, security monitoring, incident response planning, and employee security awareness programmes.
The business value extends beyond technical protection. A recognised certification can also help procurement teams assess suppliers, demonstrate security commitments to customers, and support internal governance requirements.
Why Do UK Businesses Need Cyber Essentials?
UK businesses need Cyber Essentials to establish a recognised cybersecurity baseline, meet applicable contractual requirements, strengthen supplier relationships, and demonstrate that they take information security seriously.
Although certification is not legally compulsory for every UK business, specific government contracts and private-sector agreements may require it.
Government and MOD Contracts
Cyber Essentials has a direct connection with UK public-sector procurement.
Under Procurement Policy Note 014 (PPN 014), applicable central government departments, executive agencies, non-departmental public bodies, and NHS bodies must consider proportionate cybersecurity requirements for contracts with specified security characteristics.
These include contracts involving:
- • Citizens’ personal information, such as financial or payment details.
- • Government employee information.
- • Government ICT systems and services handling OFFICIAL information.
- • Information related to government operations, public finances, and service delivery.
For applicable contracts, suppliers may need Cyber Essentials or Cyber Essentials Plus certification or demonstrate equivalent controls where permitted.
The requirement is not automatically applied to every government contract. Procurement teams must assess whether it is relevant and proportionate.
The Ministry of Defence also uses cybersecurity requirements through its Defence Cyber Protection Partnership framework. Suppliers should verify the security level and certification requirements specified in their individual contracts.
Supply-Chain Security Requirements
Enterprise procurement teams increasingly evaluate supplier security controls, particularly where third parties access internal systems, handle sensitive information, or support critical business operations.
For example, a technology provider handling customer records or a managed IT provider accessing business infrastructure may need to demonstrate that appropriate security controls are in place.
Cyber Essentials provides a standardised way to communicate baseline security practices.
Businesses can use certification to:
- • Respond to supplier security questionnaires.
- • Demonstrate baseline technical controls during procurement.
- • Support third-party risk assessments.
- • Build confidence among enterprise customers.
- • Strengthen their position when bidding for applicable contracts.
However, certification alone does not replace a customer’s full supplier due-diligence process.
Cyber Liability Insurance for Eligible Organisations
Eligible UK organisations with an annual turnover below £20 million that achieve Cyber Essentials certification covering their entire organisation are entitled to cyber liability insurance arranged through IASME.
The published scheme information includes a £25,000 liability limit and access to a 24-hour incident reporting helpline with crisis management and incident response support.
Businesses should review the current policy wording, exclusions, eligibility requirements, and coverage conditions before relying on this provision.
How Does Certification Support Business Growth?
Cyber Essentials can contribute to commercial assurance by helping organisations demonstrate baseline security controls to customers, procurement teams, and business partners.
| Business priority | How certification helps |
|---|---|
| Public-sector procurement | Supports eligibility for applicable contracts. |
| Enterprise partnerships | Provides evidence of baseline security practices. |
| Customer confidence | Demonstrates a structured approach to cybersecurity. |
| Supplier management | Supports security assessments and vendor reviews. |
| Risk management | Encourages consistent application of essential controls. |
| Business continuity | Reduces exposure to several common attack methods. |
For organisations assessing their current security posture, a cybersecurity risk assessment can help identify weaknesses and prioritise remediation before certification.
What Are the Key Technical Controls of Cyber Essentials?
Cyber Essentials evaluates five technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection. These controls establish a baseline for protecting devices, networks, accounts, and business information against common cyber threats.
The current v3.3 requirements retain these five control areas.
1. Firewalls and Internet Gateways
Firewalls control network traffic entering and leaving an organisation’s systems. They help prevent unauthorised connections and restrict access to services that should not be publicly accessible.
Businesses should:
- • Configure firewalls on internet-connected devices where required.
- • Restrict unnecessary incoming network connections.
- • Review firewall rules regularly.
- • Change default administrative credentials.
- • Control access to network management interfaces.
Poor firewall configuration can expose internal systems and sensitive information. A documented network architecture and clear ownership of firewall rules help IT teams manage these controls consistently.
2. Secure Configuration
Secure configuration means setting up devices, applications, and operating systems with appropriate security settings before they enter business use.
Organisations should:
- • Remove or disable unnecessary software and services.
- • Change default passwords.
- • Restrict administrative privileges.
- • Apply secure configuration settings.
- • Maintain approved device configurations.
Standardised device configurations reduce inconsistencies across employee workstations and remote devices.
3. Security Update Management
Security update management focuses on applying software patches that address known vulnerabilities.
Businesses must establish a process for identifying, prioritising, and installing updates within the applicable timeframes.
This includes:
- • Operating system updates.
- • Application security patches.
- • Firmware updates.
- • Updates for network infrastructure.
- • Updates for supported cloud-based services where applicable.
A centralised patch management process helps IT teams track update status and identify devices that require attention.
4. User Access Control
User access control limits system access according to an individual’s responsibilities and business requirements.
Organisations should:
- • Create individual user accounts.
- • Remove access when employees leave.
- • Restrict administrative permissions.
- • Apply multi-factor authentication (MFA) where required.
- • Review user access periodically.
Access permissions should reflect actual job responsibilities. When employees change departments or responsibilities, their existing permissions should be reviewed rather than automatically retained.
5. Malware Protection
Malware protection involves measures that identify, prevent, and restrict malicious software from affecting business devices.
Organisations should use appropriate anti-malware protection and security features supported by their operating systems.
Key practices include:
- • Installing supported anti-malware solutions.
- • Enabling real-time protection where applicable.
- • Restricting unauthorised software execution.
- • Keeping security tools updated.
- • Reviewing malware protection settings.
Security controls should cover all devices within the certification scope, including remote endpoints and business-managed mobile devices.
The five controls at a glance:
| Technical control | Primary purpose |
|---|---|
| Firewalls | Control network connections. |
| Secure configuration | Reduce unnecessary system exposure. |
| Security updates | Address known software vulnerabilities. |
| User access control | Restrict access to authorised users. |
| Malware protection | Protect devices against malicious software. |
An important implementation consideration is that these controls work together. A business may have updated software but still expose sensitive information through excessive user permissions or poorly configured network access.
Organisations should assess the five areas as one connected security framework rather than treating each requirement as a separate IT task.
What Should Businesses Review Before Applying for Certification?
The 2026 update makes it particularly important for organisations to review their wider technology environment.
Organisations should review the following areas before applying:
1. Cloud Service Inventory
Businesses should identify the cloud platforms and services used across their operations.
This includes Microsoft 365, cloud-hosted applications, storage platforms, and other services that form part of their IT environment.
The updated requirements make cloud service scope an important part of certification preparation.
2. Identity and Authentication
Review how employees access business applications, cloud platforms, and administrative accounts.
Passwordless authentication using FIDO2 is now included in the updated terminology. Businesses should understand how their authentication methods align with the applicable requirements.
3. Software Development Security
Organisations involved in software development should review the new Software Security Code of Practice requirements.
Development environments, software components, access permissions, and security processes should receive appropriate attention.
4. Backup Management
Businesses should review their backup arrangements, including coverage, ownership, retention, and recovery procedures.
A backup policy should reflect the organisation’s operational requirements rather than exist solely as a written document.
5. Device Management
Review whether business devices have consistent security configurations, appropriate software updates, and required protective controls.
This includes devices used by remote employees where they fall within the certification scope.
6. Access Permissions
Check whether employee and administrator permissions reflect current responsibilities.
Pay particular attention to cloud administration, privileged accounts, and access to business-critical applications.
7. Certification Scope
Document the systems, business units, locations, networks, and cloud services covered by the assessment.
A clearly defined scope helps avoid inconsistencies between the questionnaire and the actual IT environment.
Cloud service ownership and configuration responsibility are not always held by the same team. For example, a finance team may manage a cloud accounting subscription while IT manages identity and access. Certification preparation should bring these responsibilities together so that the organisation has a complete view of its environment.
The updated requirements also make it useful to review zero trust architecture as part of a broader identity and access security strategy. Zero trust is not a separate Cyber Essentials certification requirement, but its principles can support stronger access management.
How Can Businesses Get Cyber Essentials Certified?
Businesses obtain Cyber Essentials by defining their certification scope, reviewing the five technical controls, completing a verified self-assessment, and submitting the questionnaire to a licensed certification body. Organisations applying for Cyber Essentials Plus must also complete an independent technical audit.
The process involves several stages.
Step 1: Define the Certification Scope
Start by identifying the systems and business operations that fall within the assessment.
This includes:
- • Business locations.
- • Employee devices.
- • Servers and network infrastructure.
- • Cloud-based services.
- • Business applications.
- • Relevant remote working environments.
The v3.3 requirements make accurate scope definition particularly important because cloud services cannot simply be excluded.
Step 2: Review the Five Technical Controls
Assess the organisation’s existing security arrangements against the five control areas.
Review firewall configurations, device settings, security updates, user access, and malware protection.
Document any areas that require attention before submitting the assessment.
Step 3: Address Technical Gaps
Prepare a remediation plan for any identified gaps.
This could involve updating unsupported software, adjusting administrator permissions, improving MFA coverage, or reviewing firewall configurations.
Assign responsibility for each action and retain appropriate records.
Step 4: Complete the Self-Assessment Questionnaire
Register through IASME or work with an approved certification body.
Complete the online questionnaire using accurate information about the organisation’s IT environment.
A senior board member or equivalent must sign off the submitted answers.
Step 5: Independent Assessment
A qualified assessor reviews the submitted questionnaire and determines whether the organisation meets the scheme requirements.
If clarification or additional information is required, the organisation may need to provide further details.
Step 6: Complete the Cyber Essentials Plus Audit
Businesses applying for Plus must complete the additional technical assessment.
The assessor tests relevant systems and devices to verify that the controls operate as stated.
Any identified issues should be addressed in accordance with the certification body’s assessment and remediation process.
Step 7: Receive Certification and Plan Renewal
Once the organisation satisfies the applicable requirements, the certification body issues the certificate.
The certificate remains valid for 12 months.
Businesses should maintain their security controls throughout the year and prepare for renewal before the certificate expires.
What Documentation Should Businesses Prepare?
Although the exact information required depends on the organisation’s environment, preparing the following records can help:
- • IT asset inventory.
- • Network and firewall information.
- • Software and operating system inventory.
- • User access records.
- • MFA configuration details.
- • Patch management procedures.
- • Malware protection information.
- • Cloud service inventory.
- • Backup policies and related records.
Organisations should also consider independent security testing where appropriate. Independent security testing can help assess application and system security as part of a wider quality and assurance programme.
How Can Businesses Prepare for Cyber Essentials Certification?
Businesses can obtain Cyber Essentials support from qualified cybersecurity consultants, IT service providers, and licensed certification bodies. The appropriate support model depends on whether the organisation requires technical remediation, certification preparation, ongoing security management, or independent assessment.
It is important to distinguish between preparing for certification and awarding certification. Only an appropriately licensed certification body can award a Cyber Essentials certificate under the scheme.
How Can a Technology Partner Help?
An experienced technology partner can help businesses prepare their IT environments and address technical requirements before applying. Support may include:
1. IT Infrastructure Assessment
Reviewing existing devices, networks, applications, and cloud services to identify potential gaps.
2. Security Configuration
Reviewing firewall settings, access permissions, device configurations, and security updates.
3. Cloud Security Management
Assessing cloud service configurations, user permissions, and identity management practices.
4. Security Testing
Performing appropriate technical testing to identify vulnerabilities and assess application security.
5. Ongoing IT Management
Supporting patch management, endpoint security, user access reviews, and infrastructure maintenance.
What Should Businesses Look for in a Cybersecurity Partner?
Choosing the right partner requires more than comparing service prices. Consider these factors:
| Evaluation area | What to look for |
|---|---|
| Technical experience | Practical knowledge of business IT environments and security controls. |
| Cloud expertise | Experience with cloud infrastructure, applications, and identity management. |
| Assessment readiness | Familiarity with the current Cyber Essentials requirements. |
| Security testing | Ability to identify technical weaknesses through appropriate testing. |
| Documentation | Clear technical records and remediation recommendations. |
| Ongoing support | Defined responsibilities for maintaining security controls. |
| Certification status | Clarity about whether the provider is an authorised certification body or a preparation partner. |
How Altumind Supports Enterprise Cybersecurity Readiness
At Altumind, we approach cybersecurity as part of the wider technology environment rather than an isolated compliance activity.
With more than 10 years of experience in technology and digital transformation, our work spans software engineering, cloud services, quality assurance, data analytics, and managed operations.
These capabilities are relevant when businesses need to review how security controls interact with their applications, infrastructure, and day-to-day operations.
Our broader managed cybersecurity and compliance services can support organisations seeking structured security management.
Businesses can also consider fully managed IT services when they need ongoing infrastructure and operational support.
The objective is to connect security improvements with business requirements, system reliability, and long-term operational priorities.
Conclusion
Cyber Essentials certification gives UK businesses a practical foundation for managing common cybersecurity risks, meeting applicable procurement requirements, and building customer confidence.
With version 3.3 introducing updated expectations for cloud services, authentication, and software security, organisations should review their technical environments regularly.
At Altumind, we help businesses address technology and security requirements together. If your organisation is reviewing its cybersecurity readiness or compliance across regulated industries, connect with our team to discuss your requirements.
Author
Practice Head, Cybersecurity
Sujatha is a cybersecurity consultant and strategic advisor who helps global enterprises secure their digital assets, maintain compliance, and build resilient infrastructure.
Armed with an MBA with Cybersecurity, a CISM certification, and extensive experience across the UK and APAC regions, she specializes in protecting complex banking and financial services environments. By combining a strong technical background with IT Service Management (ITSM) expertise, Sujatha seamlessly integrates robust security frameworks into business operations, translating complex risks into clear, strategic corporate outcomes.
